Your morning shower, the coffee you brewed, the water your kids drink at school. Most of us never give a second thought to where that water comes from or how it stays safe. We assume the municipal utility is running on hardened, impenetrable systems.
That is a dangerous assumption.
The reality is that a significant portion of the critical infrastructure in the United States is currently running on equipment that shouldn't be within reach of the public internet. If you have been paying attention to the recent advisories from the Cybersecurity and Infrastructure Security Agency (CISA), you know that the situation has moved from a "theoretical risk" to an active, real-world emergency.
The Siemens PLC Warning
In August 2026, the federal government sent a clear signal to anyone running water and wastewater facilities. They warned that programmable logic controllers (PLCs)—specifically those manufactured by Siemens, but also models from Rockwell Automation and Schneider Electric—are being actively targeted.
Think of a PLC as the brain of an industrial process. It tells a pump when to turn on, a valve when to open, and a chemical feed when to adjust chlorine levels. These devices were never designed to be plugged directly into the internet. They were designed for the "air-gapped" world of 20 years ago, where the only way to talk to the controller was to physically stand in front of it with a specialized cable.
Today, those controllers are frequently connected to cellular modems or poorly configured network gateways. Attackers are finding them, probing them, and, in some cases, locking out the human operators who are supposed to be in control.
Why This Matters Now
This isn't just about hackers trying to be annoying. When an attacker gains control of a PLC, they can do more than just view data. They can shut down a water pump, change chemical concentrations to unsafe levels, or spoof the monitoring screen so the operator thinks everything is fine while the facility is actually failing.
We have seen this happen before. Remember the late 2023 attacks on water systems involving Unitronics controllers? That wasn't a one-off. It was a wake-up call. The difference now is the scale and the speed. Agencies are reporting that bad actors are using AI to speed up the process of finding vulnerabilities and creating exploits.
You might ask, "Why don't they just patch the systems?"
It’s not that simple. Many of these facilities operate on tight budgets. Replacing a legacy controller can cost thousands of dollars, plus the labor to integrate it into an aging system that might be 30 years old. If you're a small town water manager, you're choosing between fixing a burst pipe on Main Street or upgrading a cybersecurity firewall that your board doesn't fully understand. It's an impossible choice.
The Blind Spot That Keeps Getting Missed
If you are a system administrator or an integrator, you need to look at your cellular modems. That’s the "hidden" path. Often, a vendor or a technician will install a cellular modem to provide "remote support" for a pump station. They might not even tell the main IT department about it.
These modems are almost never scanned in routine security audits because they are considered "outside" the corporate network. But to a hacker, they are an open front door. If you don't know it's there, you can't protect it.
How to Actually Protect Your Facility
You don't need a massive budget to make a meaningful dent in your risk profile. You need to focus on three things immediately.
- Get off the internet. If your PLC doesn't absolutely have to be reachable from the public web, pull the plug. If you need remote access, you must use a VPN or a secure gateway that requires multifactor authentication. No exceptions.
- Audit your hardware for default credentials. It sounds basic, but you would be shocked at how many industrial systems are still running with "admin" and "1111" as their login. Change them today. If a device doesn't support changing the password, it is a liability and it needs to be replaced or isolated.
- Find the undocumented connections. Spend a day walking your facility with a laptop and a network scanner. Look for cellular modems, strange routers, or any device that isn't on your official network map. If you don't know what it is, disconnect it until you do.
The era of "security through obscurity"—hoping that no one notices your facility is online—is over. Attackers are using automated tools to crawl the entire public address space of the internet, specifically looking for the fingerprints of these industrial devices.
You are the first line of defense for your community. Don't wait for a government advisory to tell you that your system is exposed. Assume it is, and start hardening your network before someone else decides to do it for you.
Check your external connections. Verify your password policies. Get the local infrastructure off the grid. Do it now.
